# Euler's criterion

In number theory, Euler's criterion is a formula for determining whether an integer is a quadratic residue modulo a prime. Precisely,

Let p be an odd prime and a be an integer coprime to p. Then[1][2][3]

${\displaystyle a^{\tfrac {p-1}{2}}\equiv {\begin{cases}\;\;\,1{\pmod {p}}&{\text{ if there is an integer }}x{\text{ such that }}x^{2}\equiv a{\pmod {p}},\\-1{\pmod {p}}&{\text{ if there is no such integer.}}\end{cases}}}$

Euler's criterion can be concisely reformulated using the Legendre symbol:[4]

${\displaystyle \left({\frac {a}{p}}\right)\equiv a^{\tfrac {p-1}{2}}{\pmod {p}}.}$

The criterion dates from a 1748 paper by Leonhard Euler.[5][6]

## Proof

The proof uses the fact that the residue classes modulo a prime number are a field. See the article prime field for more details.

Because the modulus is prime, Lagrange's theorem applies: a polynomial of degree k can only have at most k roots. In particular, x2a (mod p) has at most 2 solutions for each a. This immediately implies that besides 0 there are at least p − 1/2 distinct quadratic residues modulo p: each of the p − 1 possible values of x can only be accompanied by one other to give the same residue.

In fact, ${\displaystyle (p-x)^{2}\equiv x^{2}{\pmod {p}}.}$This is because ${\displaystyle (p-x)^{2}\equiv p^{2}-{2}{x}{p}+x^{2}\equiv x^{2}{\pmod {p}}.}$ So, the ${\displaystyle {\tfrac {p-1}{2}}}$ distinct quadratic residues are: ${\displaystyle 1^{2},2^{2},...,({\tfrac {p-1}{2}})^{2}{\pmod {p}}.}$

As a is coprime to p, Fermat's little theorem says that

${\displaystyle a^{p-1}\equiv 1{\pmod {p}},}$

which can be written as

${\displaystyle \left(a^{\tfrac {p-1}{2}}-1\right)\left(a^{\tfrac {p-1}{2}}+1\right)\equiv 0{\pmod {p}}.}$

Since the integers mod p form a field, for each a, one or the other of these factors must be zero. Therefore,

${\displaystyle a^{\tfrac {p-1}{2}}\equiv 1{\pmod {p}}}$ or
${\displaystyle a^{\tfrac {p-1}{2}}\equiv {-1}{\pmod {p}}.}$

Now if a is a quadratic residue, ax2,

${\displaystyle a^{\tfrac {p-1}{2}}\equiv {(x^{2})}^{\tfrac {p-1}{2}}\equiv x^{p-1}\equiv 1{\pmod {p}}.}$

So every quadratic residue (mod p) makes the first factor zero.

Applying Lagrange's theorem again, we note that there can be no more than p − 1/2 values of a that make the first factor zero. But as we noted at the beginning, there are at least p − 1/2 distinct quadratic residues (mod p) (besides 0). Therefore, they are precisely the residue classes that make the first factor zero. The other p − 1/2 residue classes, the nonresidues, must make the second factor zero, or they would not satisfy Fermat's little theorem. This is Euler's criterion.

### Alternative proof

This proof only uses the fact that any congruence ${\displaystyle kx\equiv l\!\!\!{\pmod {p}}}$ has a unique (modulo ${\displaystyle p}$) solution ${\displaystyle x}$ provided ${\displaystyle p}$ does not divide ${\displaystyle k}$. (This is true because as ${\displaystyle x}$ runs through all nonzero remainders modulo ${\displaystyle p}$ without repetitions, so does ${\displaystyle kx}$—if we have ${\displaystyle kx_{1}\equiv kx_{2}{\pmod {p}}}$, then ${\displaystyle p\mid k(x_{1}-x_{2})}$, hence ${\displaystyle p\mid (x_{1}-x_{2})}$, but ${\displaystyle x_{1}}$ and ${\displaystyle x_{2}}$ aren't congruent modulo ${\displaystyle p}$.) It follows from this fact that all nonzero remainders modulo ${\displaystyle p}$ the square of which isn't congruent to ${\displaystyle a}$ can be grouped into unordered pairs ${\displaystyle (x,y)}$ according to the rule that the product of the members of each pair is congruent to ${\displaystyle a}$ modulo ${\displaystyle p}$ (since by this fact for every ${\displaystyle y}$ we can find such an ${\displaystyle x}$, uniquely, and vice versa, and they will differ from each other if ${\displaystyle y^{2}}$ is not congruent to ${\displaystyle a}$). If ${\displaystyle a}$ is not a quadratic nonresidue, this is simply a regrouping of all ${\displaystyle p-1}$ nonzero residues into ${\displaystyle (p-1)/2}$ pairs, hence we conclude that ${\displaystyle 1\cdot 2\cdot ...\cdot (p-1)\equiv a^{\frac {p-1}{2}}\!\!\!{\pmod {p}}}$. If ${\displaystyle a}$ is a quadratic residue, exactly two remainders were not among those paired, ${\displaystyle r}$ and ${\displaystyle -r}$ such that ${\displaystyle r^{2}\equiv a\!\!\!{\pmod {p}}}$. If we pair those two absent remainders together, their product will be ${\displaystyle -a}$ rather than ${\displaystyle a}$, whence in this case ${\displaystyle 1\cdot 2\cdot ...\cdot (p-1)\equiv -a^{\frac {p-1}{2}}\!\!\!{\pmod {p}}}$. In summary, considering these two cases we have demonstrated that for ${\displaystyle a\not \equiv 0\!\!\!{\pmod {p}}}$ we have ${\displaystyle 1\cdot 2\cdot ...\cdot (p-1)\equiv -\left({\frac {a}{p}}\right)a^{\frac {p-1}{2}}\!\!\!{\pmod {p}}}$. It remains to substitute ${\displaystyle a=1}$ (which is obviously a square) into this formula to obtain at once Wilson's theorem, Euler's criterion, and (by squaring both sides of Euler's criterion) Fermat's little theorem.

## Examples

Example 1: Finding primes for which a is a residue

Let a = 17. For which primes p is 17 a quadratic residue?

We can test prime p's manually given the formula above.

In one case, testing p = 3, we have 17(3 − 1)/2 = 171 ≡ 2 ≡ −1 (mod 3), therefore 17 is not a quadratic residue modulo 3.

In another case, testing p = 13, we have 17(13 − 1)/2 = 176 ≡ 1 (mod 13), therefore 17 is a quadratic residue modulo 13. As confirmation, note that 17 ≡ 4 (mod 13), and 22 = 4.

We can do these calculations faster by using various modular arithmetic and Legendre symbol properties.

If we keep calculating the values, we find:

(17/p) = +1 for p = {13, 19, ...} (17 is a quadratic residue modulo these values)
(17/p) = −1 for p = {3, 5, 7, 11, 23, ...} (17 is not a quadratic residue modulo these values).

Example 2: Finding residues given a prime modulus p

Which numbers are squares modulo 17 (quadratic residues modulo 17)?

We can manually calculate it as:

12 = 1
22 = 4
32 = 9
42 = 16
52 = 25 ≡ 8 (mod 17)
62 = 36 ≡ 2 (mod 17)
72 = 49 ≡ 15 (mod 17)
82 = 64 ≡ 13 (mod 17).

So the set of the quadratic residues modulo 17 is {1,2,4,8,9,13,15,16}. Note that we did not need to calculate squares for the values 9 through 16, as they are all negatives of the previously squared values (e.g. 9 ≡ −8 (mod 17), so 92 ≡ (−8)2 = 64 ≡ 13 (mod 17)).

We can find quadratic residues or verify them using the above formula. To test if 2 is a quadratic residue modulo 17, we calculate 2(17 − 1)/2 = 28 ≡ 1 (mod 17), so it is a quadratic residue. To test if 3 is a quadratic residue modulo 17, we calculate 3(17 − 1)/2 = 38 ≡ 16 ≡ −1 (mod 17), so it is not a quadratic residue.

Euler's criterion is related to the law of quadratic reciprocity.

## Applications

In practice, it is more efficient to use an extended variant of Euclid's algorithm to calculate the Jacobi symbol ${\displaystyle \left({\frac {a}{n}}\right)}$. If ${\displaystyle n}$ is an odd prime, this is equal to the Legendre symbol, and decides whether ${\displaystyle a}$ is a quadratic residue modulo ${\displaystyle n}$.

On the other hand, since the equivalence of ${\displaystyle a^{\frac {n-1}{2}}}$ to the Jacobi symbol holds for all odd primes, but not necessarily for composite numbers, calculating both and comparing them can be used as a primality test, specifically the Solovay–Strassen primality test. Composite numbers for which the congruence holds for a given ${\displaystyle a}$ are called Euler–Jacobi pseudoprimes to base ${\displaystyle a}$.

## Notes

1. ^ Gauss, DA, Art. 106
2. ^ Dense, Joseph B.; Dence, Thomas P. (1999). "Theorem 6.4, Chap 6. Residues". Elements of the Theory of Numbers. Harcourt Academic Press. p. 197. ISBN 9780122091308.
3. ^ Leonard Eugene Dickson, "History Of The Theory Of Numbers", vol 1, p 205, Chelsea Publishing 1952
4. ^ Hardy & Wright, thm. 83
5. ^ Lemmermeyer, p. 4 cites two papers, E134 and E262 in the Euler Archive
6. ^ L Euler, Novi commentarii Academiae Scientiarum Imperialis Petropolitanae, 8, 1760-1, 74; Opusc Anal. 1, 1772, 121; Comm. Arith, 1, 274, 487

## References

The Disquisitiones Arithmeticae has been translated from Gauss's Ciceronian Latin into English and German. The German edition includes all of his papers on number theory: all the proofs of quadratic reciprocity, the determination of the sign of the Gauss sum, the investigations into biquadratic reciprocity, and unpublished notes.

• Gauss, Carl Friedrich (1986), Disquisitiones Arithemeticae (Second, corrected edition), translated by Clarke, Arthur A. (English), New York: Springer, ISBN 0-387-96254-9
• Gauss, Carl Friedrich (1965), Untersuchungen über höhere Arithmetik (Disquisitiones Arithemeticae & other papers on number theory) (Second edition), translated by Maser, H. (German), New York: Chelsea, ISBN 0-8284-0191-8